Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 21:22
Static task
static1
Behavioral task
behavioral1
Sample
C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe
Resource
win7-20240704-en
General
-
Target
C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe
-
Size
1.1MB
-
MD5
aee4097044780df89dc9f72c5272d1be
-
SHA1
116b730681b60b1e6ef9a61251fba364697c748f
-
SHA256
a9b0b14c72cc984aced3f9494be42f0b45803d8fc816449c81ae774f4fd4970d
-
SHA512
0d4a9eb495d2e66a52e7bd7e0753b480bb6823ba663efe4f47af988c0952dc1c0de3c1cb2c9670185897be6941c8f9a3ef6acb9459bb34c9be14781f1b579533
-
SSDEEP
24576:kfsR8o3JTx4kuyQnYmEopLYf/TZRIG5tbO3HQyTB/kAZYwF8:kc8o312kuyQnYmEIeRIG5t0HQk+Aq/
Malware Config
Extracted
danabot
5
23.254.217.192:443
192.236.146.173:443
23.254.133.7:443
185.62.58.85:443
-
embedded_hash
3CCDCA270E94321B76E2E66C454CD541
-
type
loader
Signatures
-
Blocklisted process makes network request 50 IoCs
Processes:
rundll32.exeflow pid process 11 2608 rundll32.exe 14 2608 rundll32.exe 15 2608 rundll32.exe 16 2608 rundll32.exe 17 2608 rundll32.exe 18 2608 rundll32.exe 19 2608 rundll32.exe 20 2608 rundll32.exe 21 2608 rundll32.exe 22 2608 rundll32.exe 23 2608 rundll32.exe 24 2608 rundll32.exe 25 2608 rundll32.exe 26 2608 rundll32.exe 27 2608 rundll32.exe 28 2608 rundll32.exe 29 2608 rundll32.exe 30 2608 rundll32.exe 31 2608 rundll32.exe 32 2608 rundll32.exe 33 2608 rundll32.exe 34 2608 rundll32.exe 35 2608 rundll32.exe 36 2608 rundll32.exe 37 2608 rundll32.exe 38 2608 rundll32.exe 39 2608 rundll32.exe 40 2608 rundll32.exe 41 2608 rundll32.exe 42 2608 rundll32.exe 43 2608 rundll32.exe 44 2608 rundll32.exe 45 2608 rundll32.exe 46 2608 rundll32.exe 47 2608 rundll32.exe 48 2608 rundll32.exe 49 2608 rundll32.exe 50 2608 rundll32.exe 51 2608 rundll32.exe 52 2608 rundll32.exe 53 2608 rundll32.exe 54 2608 rundll32.exe 55 2608 rundll32.exe 56 2608 rundll32.exe 57 2608 rundll32.exe 58 2608 rundll32.exe 59 2608 rundll32.exe 60 2608 rundll32.exe 61 2608 rundll32.exe 62 2608 rundll32.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\EjuvLf.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
EjuvLf.exepid process 2316 EjuvLf.exe -
Loads dropped DLL 2 IoCs
Processes:
C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exepid process 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe -
Drops file in Program Files directory 64 IoCs
Processes:
EjuvLf.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe EjuvLf.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe EjuvLf.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe EjuvLf.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe EjuvLf.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe EjuvLf.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe EjuvLf.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe EjuvLf.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe EjuvLf.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe EjuvLf.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe EjuvLf.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe EjuvLf.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe EjuvLf.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe EjuvLf.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{25A399C8-ED60-41E8-9A07-9F291B0E4835}\chrome_installer.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe EjuvLf.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE EjuvLf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe EjuvLf.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe EjuvLf.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE EjuvLf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE EjuvLf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE EjuvLf.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe EjuvLf.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe EjuvLf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE EjuvLf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe EjuvLf.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe EjuvLf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exeEjuvLf.exerundll32.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EjuvLf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exeEjuvLf.exedescription pid process target process PID 2360 wrote to memory of 2316 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe EjuvLf.exe PID 2360 wrote to memory of 2316 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe EjuvLf.exe PID 2360 wrote to memory of 2316 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe EjuvLf.exe PID 2360 wrote to memory of 2316 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe EjuvLf.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2360 wrote to memory of 2608 2360 C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe rundll32.exe PID 2316 wrote to memory of 1660 2316 EjuvLf.exe cmd.exe PID 2316 wrote to memory of 1660 2316 EjuvLf.exe cmd.exe PID 2316 wrote to memory of 1660 2316 EjuvLf.exe cmd.exe PID 2316 wrote to memory of 1660 2316 EjuvLf.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe"C:\Users\Admin\AppData\Local\Temp\C72AA9C4DF96E6768A8A1DB299A8E787AC729FAA40C536FA4344F82D4670A947.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\EjuvLf.exeC:\Users\Admin\AppData\Local\Temp\EjuvLf.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\54097a9b.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1660
-
-
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\k2[1].rar
Filesize4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
187B
MD5adaa89d7410977ade5f9797b0ded63c2
SHA18c4fbaed8c4b6ed662f1b2b37746619f8b5e3974
SHA256dee3e6ff7805299b40e4913e57e0f565e0de7db1a437bb4dea258bc8bd3c89d4
SHA5122b5508883fa51af13ac9cb007bd7cdc1770636c3b76ef1428ae50f3b4a56d642961813a5ea039979b2fda7deaf4c9d95b211feab0ed33437dfe902f1138210be
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3